Simplify root-scoped cleanup

docs/internal/fileops.md

@@ -21,11 +21,12 @@ no-replace primitive reject promotion before writing a temporary tree.
 
 ## Cleanup Contract
 
-`RemoveAllUnderRoot` accepts an explicit root and a proper descendant. It opens
-the root and each target ancestor without following symlinks, then removes the
-tree through those directory handles. It rejects root deletion and any symlink
-encountered in the target path or tree; repeated removal of a missing target is
-successful. Command and post-publish policy remains owned by `internal/app`.
+`RemoveAllUnderRoot` accepts an explicit root and a proper descendant, opens
+that root with `os.OpenRoot`, and removes the normalized root-relative target
+with `Root.RemoveAll`. It rejects root, traversal, and out-of-root targets; a
+missing target is successful. `RemoveFileUnderRoot` additionally requires an
+existing leaf to be regular. Command and post-publish policy remains owned by
+`internal/app`.
 
 ## Bounded Reads
 

docs/internal/workspace.md

@@ -14,8 +14,8 @@ path model, and layout creation goes through `EnsureLayoutFor`. Callers should
 consume those helpers instead of rebuilding relative paths.
 
 `internal/pathsafe` validates relative destinations. `internal/fileops` opens
-cleanup roots and their descendants through no-follow directory handles before
-removing them.
+explicit cleanup roots and removes only normalized proper descendants through
+the resulting root handle.
 
 `internal/fileops` owns the ordinary workspace mode contract. On POSIX,
 `WorkspaceDirectoryMode` is setgid `02775` and `WorkspaceFileMode` is `0664`.
@@ -60,8 +60,7 @@ Automatic post-publish cleanup:
   key in publish metadata;
 - consumes the resolved cleanup policy described in
   [Configuration](../config.md);
-- refuses unsafe deletes (root delete, out-of-root delete, and symlinked
-  ancestors or entries);
+- refuses unsafe deletes (root delete, traversal, and out-of-root targets);
 - retries any recorded incomplete target on later invocations even when no
   publish work is selected. Missing targets are a successful, idempotent
   cleanup result only after the completion evidence is saved.

docs/operations.md

@@ -555,7 +555,7 @@ Rules:
 - `clean` deletes work/spool session state;
 - cache is preserved unless `--clear-cache` is set;
 - each deletion is confined beneath its configured workspace, spool, or cache
-  root and refuses symlinked paths;
+  root; root, traversal, and out-of-root targets are refused;
 - automatic post-publish cleanup is gated by successful publish commit plus:
   - `pipeline.spool.delete_audio_after_publish=true`
   - `pipeline.workspace.cleanup_after_publish=true`

docs/roadmap/implementation.md

@@ -369,7 +369,7 @@ object model.
 
 ## Stage 4 — Replace Custom Cleanup Traversal With `os.Root`
 
-**Status: Pending**
+**Status: Completed**
 
 ### Goal
 

docs/troubleshooting.md

@@ -362,8 +362,8 @@ Likely causes:
 Safe fix:
 
 - allow the automatic rerun after verifying the current configuration. Treat
-  an unsafe path or symlink error as filesystem corruption or tampering and
-  investigate it rather than replacing files manually.
+  an unsafe path or bundle symlink error as filesystem corruption or tampering
+  and investigate it rather than replacing files manually.
 
 ## Notarius transitive configuration changed